Proposals to extend marine planning zones: updated data protection impact assessment

8. Data Protection Officer (DPO) advice

1. Can you confirm that no special category data is being processed as part of this consultation?

Action: Yes, that is correct - no special category data is being processed. This is referenced under the Identification Methods section on page 8 of the DPIA

2. Please confirm the review date of the DPIA

Action: Review date included

3. The DPIA needs to capture how all information is to be processed as part of this consultation so the further details need to be included on the processing of the manual forms etc and emails received both in terms of Storage/access and deletion as DPIA only covers Citizen Space for the full processing journey

Action: Updated to note that responses received via post or email will be uploaded on to Citizen Space by the Scottish Government, the original document or email when then be destroyed/deleted.

4. You have identified you will be relying on public task as your lawful basis – can I ask if this is statutory or non-statutory consultation?

Action: Consultation is statutory requirement under Town and Country Planning (Scotland) Act 1997, Section 26, (6H):

Before making an order under subsection (6C), the Scottish Ministers—

(a)must consult—

(i)every planning authority, and

(ii)the Scottish Environment Protection Agency, and

(b)may consult such other persons as they think fit

The DPIA has been updated to reflect this

5. You reference the public at large – I would consider using the term Respondents or Consultation Participants so their stakeholder role is clear

Action: Updated to ‘Respondents (members of public)’ as we want to make clear that one of the respondent group is likely to be individuals rather than specified groups or organisations

6. In terms of data retention, the personal data can only be retained for as long as it is necessary. My understanding from the current description is that although it will be reviewed at the 12 month stage you are potentially keeping the information indefinitely. You will need a strong justification for retaining the data indefinitely. I would recommend providing a clear retention point for transparency for the participants.

Action: The Data Purging and Archival section (page 5) has been updated to provide information on instances where data retention may be required (extension of consultation period beyond DPIA review date)

7. Please note that Citizen Space is used as the tool to facilitate the consultation, however your business area is the owner of the data and will be responsible for ensuring the data within is managed in line with your retention schedule.

Action: Data Collection, Storage and Transfer section has been updated to reflect this advice

8. Other Risk – you may want to consider including impacts such as publication in error, data subjects not being able to exercise rights, retaining information for longer than is necessary etc

Action: The following sections of the DPIA have been updated to outline these risks and how they will be mitigated against, rather than including in the Other Risks section

Data Subjects (Page 4)

Data Publication (Page 5)

Data Purging and Archival (Page 5)